[Snort-users] alert never triggers

Sheahan, Paul (PCLN-NW) Paul.Sheahan at ...2218...
Tue Jun 26 14:54:20 EDT 2001

I am trying to check for instances where Remotely Possible connections occur
on my network. I researched the correct protocol and port being used
(tcp:799) and even used a sniffer to confirm. If destination port is 799,
then someone initiated a Remotely Possible session. If the source port is
799, then the RP session is already established and this is a response from
the host. I put the following two rules in a file called my.rules which is
the first include in snort.conf. I make RP connections all day but they
never generate the alert. These are the alerts I use:

alert tcp any any -> any 799 (msg:"RP session initiated port 799";)
alert tcp any 799 -> any any (msg:"RP session established port 799";)

Does anyone have an idea why this wouldn't work? All of my other alerts in
my.rules seem to alert properly.

Thanks for the help!

More information about the Snort-users mailing list